The 2026 report by the Cambridge Centre for Alternative Finance (CCAF), with BIS, IMF, WEF and others, shows 81% of financial firms use AI and software engineering is the most mature use — yet concern over lost human oversight and weak explainability is serious.
The "2026 Global AI in Financial Services Report" was published by the Cambridge Centre for Alternative Finance (CCAF) at Cambridge Judge Business School with the BIS, IMF, World Economic Forum, IDB, CGAP and AMF. The survey covered financial services firms, AI providers and 130 regulatory bodies worldwide.
Adoption: 81% of financial firms use AI to some degree and 40% are at advanced stages (scaling or transforming). By contrast, only 20% of supervisory authorities have reached advanced adoption. 71% use generative AI and 52% are actively deploying agentic AI. Fintechs are ahead of traditional institutions: 47% versus 30% at advanced adoption.
The most mature use is software engineering: 42% have fully deployed it and 33% are developing it. Process automation (79%) and data visualization (75%) are also prominent reported uses.
The main risks are similar across groups: privacy and data protection (65 to 80 percent depending on the group), hallucination and unreliable model outputs (67 to 70 percent), and operational resilience (46 to 59 percent). 51% of respondents rank "loss of human oversight" as the third-biggest AI risk, and only about half of the industry has adopted explainable AI methods.
From a supervisory perspective, 69 to 79 percent of respondents (depending on the group) want clearer guidance from regulators. The report stresses fixing data-quality constraints, reskilling the workforce and strengthening supervisory frameworks for deploying AI agents.
An analytical reading from putting these numbers side by side (our interpretation): when more than half of organizations are deploying AI agents, yet only about half have explainable methods and only 20% of supervisors have reached advanced adoption themselves, a gap appears between the pace of deployment and the pace of governance. It is reasonable to expect regulatory requirements to tighten in the future.
For technology leaders in financial institutions the practical message is to build governance before scaling, not after: data classification, human approval for high-risk decisions, full logging and traceability of model decisions, and continuous quality evaluation of outputs. An organization that has this infrastructure is in a better position when regulation tightens.
This note is a summary and rewrite based on the report below; see the original source for the full report.
Cambridge Centre for Alternative Finance (CCAF)According to a SiliconANGLE report on September 18, 2026, a week that saw multi-billion-dollar AI infrastructure investments alongside safety tools to rein in rogue agents — the AI-agent industry's paradox.
Research by Medrano, Verma and Chhabra shows that in a production-like RAG system, RAG Fusion raises recall, but after re-ranking and context truncation much of the gain disappears and precision even dips slightly.
On May 7, 2026 Microsoft disclosed two vulnerabilities, CVE-2026-26030 and CVE-2026-25592, in Semantic Kernel where a simple prompt injection ended in code execution on the host — a clear example that every tool available to the model is a new attack surface.
